1. The Field of the Invention
The present invention relates to network security technologies, and more specifically, to mechanisms for detecting viruses by executing code associated with an e-mail in a virtual machine.
2. Background and Relevant Art
Computing technology has revolutionized the way people work and play and has contributed enormously to the advancement of humankind. Computers now aid in innumerable applications such as word processing, computer simulations, advanced gaming, voice recognition, among many more. With the advancement of networking technology, computing systems (and their associated users) may access and exchange information from all over the globe using any Internet-enabled computing system such as a desktop computer, a laptop computer, a Personal Digital Assistant (PDA), a mobile telephone, or the like. Accordingly, never before have so many had so ready access to so much information. Computers and networking technologies have played such a major role in our lives that recent years have been dubbed the “information age.”
E-mail applications, for example, allow one user to send an electronic text message to another user. Most typically, that electronic text message would be delivered much quicker than would a letter delivered via conventional postal service. It can take a matter of minutes, seconds, or potentially even just fractions thereof, to deliver an electronic text message over many miles or even between continents. Needless to say, e-mail has revolutionized communications and had provided a significant contribution to the quality of life for many millions of people.
One of the advantages of e-mail is that it allows for the delivery of text messages with attachments. The attachments may be of almost any type, even executable types such as “.dll” or “.exe” files or script files such as Javascript or VB script. When one selects an executable attachment, the attachment is typically executed. Executable code may also be embedded within the e-mail so as to be executed simply by opening the e-mail. For example, e-mails may now be in HyperText Markup Language (HTML) format, which permits script language to be executed when the HTML e-mail is simply opened.
Unfortunately, some in our society have discovered that they can inflict harm on others by sending e-mail with associated executable code that is harmful or viral in nature, whether that code be an attachment or embedded within the e-mail. The executable code is specifically drafted such that, when executed, harm is inflicted upon the receiving computing system and/or the e-mail with attachment is replicated and sent to yet other computing systems. Typically, the associated text message and/or the name of the attachment is maliciously designed to induce the user to select the attachment to thereby induce the execution of the harmful attachment. If the executable code is simply embedded in the e-mail, then mere opening of the e-mail is sufficient to cause the harm. It is anticipated that many millions, if not billions, of dollars of economic harm have been lost due to such harmful e-mail code.
Firewalls can help greatly in protecting against such attacks in some cases. Conventionally, firewalls may maintain a list of known viruses and potentially their structural characteristics. If the firewall detects e-mail code that matches these characteristics, the firewall does not allow for delivery of the e-mail. The mechanism works well for known viruses. However, new viruses are constantly being written and/or discovered. In addition, there can typically be significant time between the time that the virus is discovered and the time that the firewall is updated to protect against the new virus. Accordingly, a new virus can cause widespread harm before protective measures are put in place, even assuming the protection of a conventional firewall.
Another more dramatic approach allows system administrators to disallow the delivery of any executable attachment at all. However, there are many legitimate reasons to deliver executable attachments via e-mail. Disallowing all executable attachment deliveries would impair the meeting of such legitimate needs. Furthermore, e-mail may still be delivered that has executable code other than in attachment form.